Implement ProceduresChecklist

Assessment ToolReady to Usev1.0

Risk Assessment Checklist

Comprehensive checklist for AI risk assessments covering health, safety, fundamental rights, and technical risks.

20 min

Read Time

Intermediate

Level

Owner:AI Risk Manager

Effective:2025-12-11

Standard:STD-AI-002

Category:Risk Management

Topics:Risk assessmentHealth risksSafety risksFundamental rights

Checklist Progress

139 of 151 items completed

92%

Purpose & Instructions

This checklist provides a systematic guide for conducting AI system risk assessments per the EU AI Act requirements. Use this checklist alongside the Risk Assessment Form (FORM-AI-RM-001) to ensure comprehensive risk identification and assessment.

Complete all applicable sections
Mark each item as Complete, Partial, Not Applicable (N/A), or Not Started
Document evidence and notes for each item
Address all gaps before proceeding to next lifecycle phase
Review and update at each lifecycle phase

1.1AI system documentation reviewed

Complete

1.2Intended purpose clearly defined

Complete

1.3Target users identified

Complete

1.4Affected persons identified

Complete

1.5Operating environment defined

Complete

1.6Previous risk assessments reviewed (if any)

Complete

1.7Incident history reviewed (if any)

Complete

1.8Risk criteria established

Complete

1.9Assessment team assembled

Complete

1.10Stakeholder input obtained

Complete

2.1.1Risk of bodily injury

N/A

2.1.2Risk of fatality

N/A

2.1.3Risk of long-term health effects

N/A

2.1.4Risk to vulnerable populations (children, elderly, disabled)

N/A

2.1.5Occupational health risks

N/A

2.2.1Product safety function failure

N/A

2.2.2Safety-critical decision errors

N/A

2.2.3Emergency response failure

N/A

2.2.4Critical infrastructure disruption

N/A

2.3.1Psychological manipulation

N/A

2.3.2Stress or anxiety induction

N/A

2.3.3Addiction facilitation

N/A

2.3.4Cognitive overload

N/A

3.1.1Discrimination based on race/ethnicity

N/A

3.1.2Discrimination based on gender/sex

N/A

3.1.3Discrimination based on age

N/A

3.1.4Discrimination based on disability

N/A

3.1.5Discrimination based on religion/belief

N/A

3.1.6Discrimination based on sexual orientation

N/A

3.1.7Discrimination based on nationality/origin

N/A

3.1.8Discrimination based on socioeconomic status

N/A

3.1.9Intersectional discrimination

N/A

3.2.1Unlawful personal data processing

N/A

3.2.2Excessive data collection

N/A

3.2.3Unauthorized data sharing

N/A

3.2.4Inadequate data security

N/A

3.2.5Profiling and tracking

N/A

3.2.6Biometric data misuse

N/A

3.2.7Data subject rights violations

N/A

3.3.1Dehumanization or objectification

N/A

3.3.2Manipulation of behavior

N/A

3.3.3Undermining human autonomy

N/A

3.3.4Exploitation of vulnerabilities

N/A

3.3.5Social scoring impacts

N/A

3.4.1Freedom of expression restriction

N/A

3.4.2Freedom of assembly impact

N/A

3.4.3Freedom of movement restriction

N/A

3.4.4Right to receive information

N/A

3.5.1Fair trial/hearing impacts

N/A

3.5.2Presumption of innocence

N/A

3.5.3Right to effective remedy

N/A

3.5.4Right to explanation

N/A

3.5.5Access to justice barriers

N/A

3.6.1Rights of the child

N/A

3.6.2Workers' rights

N/A

3.6.3Consumer protection

N/A

3.6.4Education access

N/A

3.6.5Healthcare access

N/A

3.6.6Social benefits access

N/A

4.1.1Insufficient accuracy for intended use

N/A

4.1.2High error rates

N/A

4.1.3False positive impacts

N/A

4.1.4False negative impacts

N/A

4.1.5Performance degradation over time

N/A

4.1.6Edge case failures

N/A

4.2.1Adversarial attack vulnerability

N/A

4.2.2Data poisoning vulnerability

N/A

4.2.3Model extraction risk

N/A

4.2.4Input perturbation sensitivity

N/A

4.2.5Distribution shift sensitivity

N/A

4.2.6Failure under unusual conditions

N/A

4.3.1Unauthorized access to AI system

N/A

4.3.2Data breach risk

N/A

4.3.3Model theft/IP exposure

N/A

4.3.4Supply chain compromise

N/A

4.3.5Infrastructure vulnerabilities

N/A

4.4.1System availability failures

N/A

4.4.2Single point of failure

N/A

4.4.3Recovery capability gaps

N/A

4.4.4Dependency failures

N/A

5.1.1Historical bias in training data

N/A

5.1.2Representation bias (underrepresentation)

N/A

5.1.3Measurement bias

N/A

5.1.4Selection bias

N/A

5.1.5Labeling bias

N/A

5.2.1Proxy discrimination

N/A

5.2.2Algorithmic amplification of bias

N/A

5.2.3Feature selection bias

N/A

5.2.4Optimization objective bias

N/A

5.3.1Population shift from training

N/A

5.3.2Usage pattern bias

N/A

5.3.3Automation bias (over-reliance)

N/A

5.3.4Feedback loop bias

N/A

6.1Insufficient human oversight capability

N/A

6.2Inadequate override mechanisms

N/A

6.3Output interpretability limitations

N/A

6.4Alert/notification failures

N/A

6.5Human override delays

N/A

6.6Automation complacency

N/A

6.7Cognitive load on operators

N/A

6.8Training/competency gaps

N/A

7.1Lack of decision explainability

N/A

7.2Inadequate user information

N/A

7.3AI system not disclosed to users

N/A

7.4Synthetic content not identified

N/A

7.5Documentation gaps

N/A

7.6Audit trail inadequacy

N/A

8.1All identified risks have been analyzed

Complete

8.2Likelihood assessed for each risk

Complete

8.3Impact assessed for each risk

Complete

8.4Risk levels determined

Complete

8.5Risk scores calculated

Complete

8.6Risks prioritized

Complete

8.7Analysis methodology documented

Complete

9.1Treatment options identified for all significant risks

Complete

9.2Controls designed for risks to be mitigated

Complete

9.3Control owners assigned

Complete

9.4Implementation timelines established

Complete

9.5Control effectiveness criteria defined

Complete

9.6Residual risk levels assessed

Complete

9.7Risk acceptance decisions documented

Complete

9.8Risk acceptance approvals obtained

Complete

10.1Risk monitoring plan established

Complete

10.2Key risk indicators (KRIs) defined

Complete

10.3Monitoring frequency determined

Complete

10.4Monitoring responsibilities assigned

Complete

10.5Escalation thresholds defined

Complete

10.6Review schedule established

Complete

10.7Change triggers documented

Complete

11.1Risk Assessment Form (FORM-AI-RM-001) completed

Complete

11.2Risk Register updated

Complete

11.3Supporting evidence documented

Complete

11.4Assessment methodology documented

Complete

11.5Treatment plan documented

Complete

12.1Assessment reviewed by AI Risk Manager

Complete

12.2Risk treatment approved

Complete

12.3Risk acceptance approvals obtained

Complete

12.4AI System Owner sign-off obtained

Complete

12.5AI Governance Committee approval (high-risk)

Complete

1. Pre-Assessment Preparation[ ] Complete [ ] Incomplete

Not Started

2. Health and Safety Risks[ ] Complete [ ] Incomplete

Not Started

3. Fundamental Rights Risks[ ] Complete [ ] Incomplete

Not Started

4. Technical Risks[ ] Complete [ ] Incomplete

Not Started

5. Bias and Fairness Risks[ ] Complete [ ] Incomplete

Not Started

6. Human Oversight Risks[ ] Complete [ ] Incomplete

Not Started

7. Transparency Risks[ ] Complete [ ] Incomplete

Not Started

8. Risk Analysis[ ] Complete [ ] Incomplete

Not Started

9. Risk Treatment[ ] Complete [ ] Incomplete

Not Started

10. Monitoring and Review[ ] Complete [ ] Incomplete

Not Started

11. Documentation[ ] Complete [ ] Incomplete

Not Started

12. Approvals[ ] Complete [ ] Incomplete

Not Started

AI Training and Competency Procedure

Conformity Assessment Checklist

Risk Assessment Checklist

Checklist Progress

CHECKLIST INFORMATION

PRE-ASSESSMENT PREPARATION

HEALTH AND SAFETY RISK IDENTIFICATION

FUNDAMENTAL RIGHTS RISK IDENTIFICATION

TECHNICAL RISK IDENTIFICATION

BIAS AND FAIRNESS RISK IDENTIFICATION

HUMAN OVERSIGHT RISKS

TRANSPARENCY AND EXPLAINABILITY RISKS

RISK ANALYSIS VERIFICATION

RISK TREATMENT VERIFICATION

MONITORING AND REVIEW

DOCUMENTATION AND EVIDENCE

APPROVALS

CHECKLIST SUMMARY

SIGN-OFF

Platform

Resources

Community